Shuffle up and deal with qualitative risk analysis!

While it is frequently used by agile teams to size work items (e.g. user stories), Planning Poker® can also be used to facilitate other types of decision making so why not use it for qualitative risk analysis?

A common approach to this process is to utilize a scale from very low to very high or even just low, medium and high to assess the probability and impact of identified risks. One concern with this is that at the end of the risk analysis workshop the team likely ends up with a significant volume of high probability or impact risks. This forces them to do a second pass to prioritize the risks so that risk owner capacity can be focused on the valuable few.

In many cases, determination of probability or impact is done through a group discussion. This means that the same biases which affect sizing when techniques like Delphi aren’t used will be realized. Whoever speaks first or speaks loudest anchors the remaining team members to their perception of probability or impact.

Finally, I’ve seen some teams analyze risks as part of the identification process. Not doing the analysis in a batch manner might seem to be better, but it also means that the team won’t benefit from the perspective which comes after they have had the chance to review all risks. Again, this might force a second normalization pass to ensure evaluations are consistent across the risk register.

So how can Planning Poker® address these challenges?

• By using a numerical basis for qualitative risk analysis (yes, I know that sounds like an oxymoron!) we provide greater levels of granularity which should simplify the risk prioritization process.
• Planning Poker® uses a non-linear (usually Fibonacci-like) sequence. This is important because risk impacts and probability do not scale linearly. When we use low, medium or high to analyze risks, we don’t account for non-linearity.
• It removes bias from the initial individual assessment and provides a structured approach to surface and discuss differences in perception.
• It requires us to normalize our sizing at the very beginning based on the complete list of risks to be assessed. Once the team has identified all risks, they will review each and determine which risk they believe has the smallest probability and which one has the smallest impact and use those as their basis for relative assessment against all others.
• Finally, Planning Poker® can be a lot of fun – it gets people actively engaged in what can sometimes be a very dry discussion.

Scaling this technique with larger teams might be challenging, but for risk analysis sessions with up to a dozen participants it can work well.

The beautiful thing about poker (and risk analysis!) is that everybody thinks they can play – Chris Moneymaker